CVE-2025-15701: Easy Social Icons < 4.0.3 - Admin+ Stored XSS via Icon Color Settings

Q: Which deployments are most meaningfully exposed?

The issue is relevant where a high-privilege WordPress user, such as an Administrator, can change Easy Social Icons settings and does not have the unfiltered_html capability. A multisite network is given as an example of an affected environment.

Q: What access does an attacker need to exploit this?

An attacker needs high-privilege access sufficient to modify the plugin's icon color settings. This is not described as exploitable by an unauthenticated or low-privilege user.

Q: Is a temporary mitigation identified if updating is not immediately possible?

No specific configuration workaround is provided. Restrict access to the affected plugin settings to trusted high-privilege users until the plugin can be updated.

Published Nov 5, 2026

Updated

The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise and escape some of its settings before outputting them on front-end pages, which could allow high-privilege users such as Administrators to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed, for example on a multisite network.

Event History

Nov 5, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Which deployments are most meaningfully exposed?

The issue is relevant where a high-privilege WordPress user, such as an Administrator, can change Easy Social Icons settings and does not have the unfiltered_html capability. A multisite network is given as an example of an affected environment.

What access does an attacker need to exploit this?

An attacker needs high-privilege access sufficient to modify the plugin's icon color settings. This is not described as exploitable by an unauthenticated or low-privilege user.

Is a temporary mitigation identified if updating is not immediately possible?

No specific configuration workaround is provided. Restrict access to the affected plugin settings to trusted high-privilege users until the plugin can be updated.

CVE-2025-15701: Easy Social Icons < 4.0.3 - Admin+ Stored XSS via Icon Color Settings

Event History

Frequently Asked Questions

Which deployments are most meaningfully exposed?

What access does an attacker need to exploit this?

Is a temporary mitigation identified if updating is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are most meaningfully exposed?

What access does an attacker need to exploit this?

Is a temporary mitigation identified if updating is not immediately possible?